Cost Prediction

• Outcome: Review
• Latest audit: Sep 10, 2026 · 11:06 AM UTC
• Version: 2.0.0

Overview

The skill is mostly a coherent local construction cost prediction guide, but it includes unsafe model loading code that could execute code if used with an untrusted model file.

Install only if you are comfortable using it as local ML guidance. Do not load .pkl or joblib model files from email, downloads, shared folders, or other untrusted sources, and anonymize or access-control historical construction cost datasets before use.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:400

Finding

Arbitrary Code Execution Through Unsafe Model Deserialization

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 400–405
Vulnerability Type: Unsafe deserialization of an untrusted model file
Risk Level: High

Vulnerable Code

python

def load_model(filepath):
    """Load model from file"""
    model = joblib.load(filepath)
    print(f"Model loaded from {filepath}")
    return model

Technical Analysis

The load_model function passes a caller-controlled filesystem path directly to joblib.load. Joblib model files use pickle-compatible deserialization, which may invoke object reconstruction functions and execute arbitrary Python code while loading a crafted file.

The function does not:

• Restrict model files to a trusted directory.
• Reject symbolic links or path traversal.
• Verify a cryptographic hash or digital signature.
• Establish that the model was generated locally by a trusted process.
• Warn callers that untrusted Joblib or pickle-compatible files are unsafe.

Consequently, this function must not be used with downloaded, shared, user-supplied, or otherwise untrusted model files.

Attack Path

1. An attacker creates a malicious Joblib or pickle-compatible file containing a crafted object whose deserialization routine executes attacker-selected Python code.
2. The attacker persuades a user to load the file as a cost-prediction model, places it in an accessible model directory, or replaces an existing model file.
3. The malicious file path is passed to load_model(filepath).
4. joblib.load(filepath) deserializes the crafted object without authenticity or integrity validation.
5. The embedded code executes with the privileges of the Python process running the skill.

Impact Assessment

Successful exploitation provides arbitrary code execution under the account and permissions of the process running the model loader. Given the skill's declared filesystem permission, attacker code could read, modify, create, or delete ...[truncated 391 chars]

Remediation

View remediation

Remediation Suggestions

1. Never load Joblib or pickle-compatible model files from untrusted users, URLs, shared storage, or other unauthenticated sources.
2. Restrict loading to a dedicated, application-controlled model directory. Resolve the canonical path and verify that it remains inside that directory.
3. Reject symbolic links, unexpected file types, path traversal, and files writable by untrusted users.
4. Verify each model against a pinned cryptographic digest or a digital signature before deserialization. Keep signing keys outside the model directory.
5. Clearly document that joblib.load is safe only for trusted artifacts produced by an authorized training process.
6. Where feasible, use a model format designed for safer data-only interchange rather than general Python object deserialization.
7. If Joblib is unavoidable, perform deserialization in an isolated, least-privileged process or container with no network access, minimal filesystem access, resource limits, and no sensitive credentials.
8. Separate uploaded or newly received files from trusted models. Promote a model into the trusted store only after provenance, integrity, and compatibility validation.

SkillSpector

Vulnerability Patterns

• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

This markdown file describes working with historical construction project data and later examples include fields such as location and total_cost, but the skill text does not warn users about confidentiality or careful handling of proprietary project data. For a markdown skill description, omission of privacy or data-sensitivity warnings for business-sensitive data fits the missing user warnings category.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest description explicitly names three model families as the scope of the skill, implying those are the supported modeling approaches. The file adds a separate Gradient Boosting training path, which expands behavior beyond the described set rather than serving as an obvious implementation detail of one of the listed models.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.